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Mobile Phone Sniffer 


track down mobile phones using this handy directional finder 


Design by B. Kainka 


In some situations and locations, the use of a mobile phone is forbidden. You may 


be discussing sensitive information in a closed meeting or holding important 


exams. How can you be sure that a concealed phone is not being used to pass 


information outside? Maybe you’re just curious and would like to know if some- 


one nearby is using a phone. This neat unit will not only detect the presence 


of mobile phone activity (voice or text), it can home in on the culprit! 


My 
CS 


If you are not familiar with the characteristic 
RF pulses sent out by a mobile cell phone 
just go over to an FM radio and switch the 
mobile on or off while holding it close to the 
radio aerial. These radio frequency (RF) 
pulses are an annoyance to amateur radio 
enthusiasts because they always seem to be 
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picked up by sensitive input stages 
and you sometimes hear them on 
Outside Broadcast television pro- 
grammes where people close to the 
presenter are using a mobile. 
Detecting these pulses is not dif- 
ficult; all you need is a small aerial, a 


diode detector and amplifier. Better 
still, why not double-up on the entire 
circuit, use directional aerials offset 
by 90° and feed the signals into a 
stereo headset to produce a direc- 
tional detector for pin-pointing cell- 
phones! 

Apart from mobile phones this 
unit can also pick-up the signals 
sent out by modern digital cordless 
(DECT) phones. These operate 
around the same frequency as cell 
phones. As with cell phones you will 
not be able to eavesdrop on conver- 
sations because the speech is digi- 
tally encoded but you will be able to 
hear the telltale RF pulses. 

Microwave ovens operate in the 
SHF band at about 2,400 MHz and 
you can use this unit to check for RF 
leaks around the door seal. Adding a 
few turns to the two coils and 
increasing the antennae length will 
allow you to experiment at lower fre- 
quencies in the short wave radio 
spectrum (not in stereo however). 


Elementary, 


my dear Watson 

This circuit for the Sniffer unit (Fig- 
ure 1) is quite simple. Looking at 
just one half of the circuit, the dipole 
antenna arms A1 and A2 form a res- 
onant circuit with L1. Diode D1 
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detects the RF pulses and the signal 
is amplified by IC1. 

A dual operational amplifier type 
LM358 forms the headphone ampli- 
fier. The ‘power-on’ LED D3 also pro- 
vides a reference voltage for the vir- 


tual earth inputs for IC1. The output 
signal is direct coupled to the stan- 
dard Walkman type headphones via 
R4; this means that the amplifier 
operates in class ‘A’ mode giving 
lower distortion even at high output 
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Figure |. The Sniffer circuit diagram consists of stereo UHF receivers! 
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signal levels. 

The elements for each dipole antenna are 
made up of two lengths of wire from 3 to 
7.5 cm long arranged in-line. These two 
antennae are fitted at 90° to each other at the 
corners of the PCB. This arrangement works 
rather like your ears and gives you spatial 
awareness of the transmitter direction (handy 
for pin-pointing a cellphone if many phones 
are sending simultaneously). 


Construction 


Detector diodes D1 and D2 are shown in the 
parts list as BAT43 or BAT45 Schottky diodes. 
Three alternative germanium diodes are also 
listed, and during tests these actually 
improved the Sniffer units sensitivity! The 
popular BAT85 Schottky diode is unsuitable 
in this application because it has poor high 
frequency characteristics. The construction of 
L1 and L2 is not critical. In the prototype, we 
wound the ten turns around a 5mm diameter 
LED before removing the LED and fitting the 
coils to the PCB. The on/off switch (S1) for the 
unit is connected to two pads on the PCB 
(Figure 2). If the switch is fitted with change- 
over contacts, the unused connections can 
simply be clipped off. A press-to-make push- 
button can be used for S1; this would ensure 
that you never accidentally leave the unit 
switched on. 

Make certain that the battery connector is 
correctly connected to the PCB. The red cable 
will carry +9 V from the battery but if you are 
in any doubt check with a voltmeter. Fit all 
the components to the PCB but do not plug 
IC1 into its socket yet. Before connecting 
power to the Sniffer unit, double-check that 
all the polarised components are correctly fit- 
ted. If the LED lights when the battery is fit- 
ted, S1 is switched on and you are confident 
that all is in order, turn off the unit and fit IC1 
carefully into its socket. 

Fit the Sniffer unit into any suitable case 
that will accept the PCB and battery. 

The phone Sniffer’s sensitivity is depen- 
dent on three factors: The type of diodes 
used, the length of the antennae and the volt- 
age gain of amplifiers IC1A and IC1B. 

The antenna length is matched to the radio 
frequency of interest. GSM phones transmit 
at around 950 MHz so each arm of the dipole 
should be half the wavelength or 7.5 cm (3 cm 
for phones operating in the new 1800 MHz 
band). Try experimenting with aerial length. 
The wire type is not critical but its best to 
choose a fairly thick wire gauge that will not 
bend too easily. It’s important to make strong 
soldered joints for the aerials so it is best to 
fit solder posts to the PCB aerial pads and 
solder the aerials to the posts. 
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Trying it out 

Test the unit with a mobile phone. Turn the 
ringer off on the phone and then ring up the 
mobile from another phone. There is no need 
to answer the mobile because it emits RF 
pulses whenever it receives an incoming call 
request. Start off 1 to 2 metres away from the 
phone switch on the Sniffer and make sure 
that the bleeping sounds in the headset are 
equal volume when the Sniffer is pointing 
directly at the phone. Point the Sniffer off to 
the left of the phone and the bleeps in the left 
headphone should get softer. If the opposite 
occurs you have mixed up the wiring to the 
headphone socket. Don't panic, the problem 
can be fixed without even warming up the 
soldering iron: If it’s not comfortable wearing 
the headphones round the other way, then 
just flip the Sniffer unit over and use it 
upside-down! 

The range at which the Sniffer can detect 
a mobile is dependent on the RF power out- 
put of the phone. GSM phones alter their radi- 
ated power dynamically. The nearer the 
phone is to the base station, the less transmit 
power it will need to reach it. This is partly 
done to conserve battery life. 

The amplifier gain can be increased to 
improve the Sniffer’s detection range. Feed- 
back resistors R3 and R7 set the gain of 
amplifiers IC1.A and IC1.B. Try increasing 
both of these up to 1 MQ or even 10 MQ. It 
will not cause any damage and you will soon 
know when the amplification factor is too 
high because the headphone noise level 
increases and eventually the amplifier will 
start to whistle. 

I’m sure I’m not the only one who rings my 
mobile number to find out where I have left 
the phone but what if the mobile’s ringer is 
turned off? No problem for the Sniffer, it can 
simply pin-point the (silently) ringing mobile 
by homing in on its RF pulses! Sounds like a 
good idea for a party game... 

(010128-1) 
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Figure 2. PCB layout and component placement. 


COMPONENTS LIST 


Resistors: 
RI,RS = 100kQ 
R2,R6 = IkQ 
R3,R7 = 820kQ 
R4,R8 = 2200 
R9 = 2kQ2 


Capacitors: 
C1,C2,C3 = 100nF 
C4 = |00uF 1 6V radial 


Inductors: 

LI,L2 = 10 turns of 0.3-0.5mm diam- 
eter (30-24 SWG) enamelled copper 
wire, internal diameter 5mm (see 
text) 


Semiconductors: 
D1,D2 = BAT43, BAT45, AAI 12, 


AAI 16, AAI I9 
D3 = LED, low-current 
ICI = LM358 P 


Miscellaneous: 

KI = STEREO socket for 3.5mm jack 
plug, PCB mount (e.g. Conrad Elec- 
tronics #732893) 

S| = on/off switch or pushbutton, | 
make contact 

9-V battery (PP3) with clip-on leads 

8-way IC socket 

Case with battery compartment, e.g., 
Pactec type K-RC-24-9VB-BC (Con- 
rad Electronics #522864) 

Antennae: 2 wire pieces, length 3 to 
7.5cm each (see text). 
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